gochat/backend/internal/auth/permission.go

package auth

// Reference: P2E §2 — RBAC permission system
// Replaces Chatwoot's Pundit Policy classes with a unified PolicyContext + permission matrix.

// Permission represents a single permission in the system.
type Permission string

// All permissions are organized by resource:action pattern.
// Reference: Chatwoot's Pundit policies → GoChat flat permission constants
const (
	// Account permissions
	PermAccountCreate    Permission = "account:create"
	PermAccountRead      Permission = "account:read"
	PermAccountUpdate    Permission = "account:update"
	PermAccountDelete    Permission = "account:delete"
	PermAccountManageUsers Permission = "account:manage_users"

	// Inbox permissions
	PermInboxCreate  Permission = "inbox:create"
	PermInboxRead    Permission = "inbox:read"
	PermInboxUpdate  Permission = "inbox:update"
	PermInboxDelete  Permission = "inbox:delete"

	// Conversation permissions
	PermConversationRead      Permission = "conversation:read"
	PermConversationCreate    Permission = "conversation:create"
	PermConversationUpdate    Permission = "conversation:update"
	PermConversationAssign    Permission = "conversation:assign"
	PermConversationResolve   Permission = "conversation:resolve"
	PermConversationDelete    Permission = "conversation:delete"
	PermConversationManageLabels Permission = "conversation:manage_labels"

	// Message permissions
	PermMessageRead    Permission = "message:read"
	PermMessageCreate  Permission = "message:create"
	PermMessageUpdate  Permission = "message:update"
	PermMessageDelete  Permission = "message:delete"

	// Contact permissions
	PermContactCreate  Permission = "contact:create"
	PermContactRead    Permission = "contact:read"
	PermContactUpdate  Permission = "contact:update"
	PermContactDelete  Permission = "contact:delete"
	PermContactMerge   Permission = "contact:merge"
	PermContactExport   Permission = "contact:export"

	// Report permissions
	PermReportRead     Permission = "report:read"
	PermReportExport    Permission = "report:export"

	// Automation permissions
	PermAutomationCreate  Permission = "automation:create"
	PermAutomationRead    Permission = "automation:read"
	PermAutomationUpdate  Permission = "automation:update"
	PermAutomationDelete  Permission = "automation:delete"

	// Team permissions
	PermTeamCreate  Permission = "team:create"
	PermTeamRead    Permission = "team:read"
	PermTeamUpdate  Permission = "team:update"
	PermTeamDelete  Permission = "team:delete"

	// Captain AI permissions (Enterprise 🔒)
	PermCaptainRead   Permission = "captain:read"
	PermCaptainManage  Permission = "captain:manage"
	PermCopilotUse     Permission = "copilot:use"

	// Super admin permissions
	PermSuperAdminAll Permission = "super_admin:all"
	PermPlatformManage Permission = "platform:manage"
)

// Role defines user roles in the system.
// Reference: Chatwoot's AccountUser roles (agent, administrator) + super_admin
type Role string

const (
	RoleSuperAdmin    Role = "super_admin"
	RoleAdministrator Role = "administrator"
	RoleAgent         Role = "agent"
	RoleCustom        Role = "custom" // Enterprise 🔒
)

// PermissionMatrix defines which roles have which permissions.
// Reference: P2E §2.2 — replaces Chatwoot's 12 Pundit Policy classes
var PermissionMatrix = map[Role][]Permission{
	RoleSuperAdmin: {
		PermSuperAdminAll,
		PermPlatformManage,
		// All other permissions implicitly granted
	},
	RoleAdministrator: {
		PermAccountRead,
		PermAccountUpdate,
		PermAccountManageUsers,
		PermInboxCreate,
		PermInboxRead,
		PermInboxUpdate,
		PermInboxDelete,
		PermConversationRead,
		PermConversationCreate,
		PermConversationUpdate,
		PermConversationAssign,
		PermConversationResolve,
		PermConversationManageLabels,
		PermMessageRead,
		PermMessageCreate,
		PermMessageUpdate,
		PermMessageDelete,
		PermContactCreate,
		PermContactRead,
		PermContactUpdate,
		PermContactDelete,
		PermContactMerge,
		PermContactExport,
		PermReportRead,
		PermReportExport,
		PermAutomationCreate,
		PermAutomationRead,
		PermAutomationUpdate,
		PermAutomationDelete,
		PermTeamCreate,
		PermTeamRead,
		PermTeamUpdate,
		PermTeamDelete,
		PermCaptainRead,
		PermCaptainManage,
		PermCopilotUse,
	},
	RoleAgent: {
		PermAccountRead,
		PermInboxRead,
		PermConversationRead,
		PermConversationCreate,
		PermConversationUpdate,
		PermConversationAssign,
		PermConversationResolve,
		PermConversationManageLabels,
		PermMessageRead,
		PermMessageCreate,
		PermMessageUpdate,
		PermContactCreate,
		PermContactRead,
		PermContactUpdate,
		PermContactMerge,
		PermReportRead,
		PermAutomationRead,
		PermTeamRead,
		PermCaptainRead,
		PermCopilotUse,
	},
}

// HasPermission checks if a role has a specific permission.
func HasPermission(role Role, perm Permission) bool {
	// Super admin has all permissions
	if role == RoleSuperAdmin {
		return true
	}

	perms, ok := PermissionMatrix[role]
	if !ok {
		return false
	}

	for _, p := range perms {
		if p == perm {
			return true
		}
	}
	return false
}

// GetPermissions returns all permissions for a role.
func GetPermissions(role Role) []Permission {
	if role == RoleSuperAdmin {
		// Return all permissions for super admin
		all := []Permission{}
		for _, perms := range PermissionMatrix {
			all = append(all, perms...)
		}
		return all
	}

	perms, ok := PermissionMatrix[role]
	if !ok {
		return []Permission{}
	}
	return perms
}